10. Responsible practice

Responsibility stays with the organisation

A useful governance process makes it clear who may do what, with which information, for what purpose and under whose review. It does not begin with a long statement that everyone should be responsible. It begins with the actual workflow: the inputs, people affected, possible errors, permissions and route back to a safe state.

This module teaches judgement and project controls, not legal advice. Requirements vary by context and can change. Before real research, fundraising, personal-data processing, synthetic media or automated communications, the organisation must obtain appropriate current privacy, legal, safeguarding and operational review. A course exercise cannot grant permission or establish compliance. Every activity here can use fictional text instead.

Classify the task before choosing the tool

Separate low-consequence internal drafting from decisions or messages that can materially affect someone. An internal list of possible headings is different from an eligibility decision, a client response or a public impact claim. The more consequential the output, the stronger the need for authoritative evidence, competent review and a dependable fallback.

Map inputs as well as outputs. Public material may still have reuse restrictions. Internal information may reveal strategic plans. A client story can contain sensitive details even if the name is removed. Combining apparently harmless details can make someone identifiable. If the permitted use is unclear, the correct course route is not to upload the material and hope for the best.

Write a permission boundary in operational language: 'Only these approved fictional facts may enter this drafting tool; client records and unpublished internal documents must not.' This is more useful than 'be careful with data'. It can be checked before the task starts. Permission to view information is not automatically permission to send it to another service.

Minimise information and access

Ask what the task actually needs. To draft a generic explanation of booking steps, the workflow needs approved process facts, not client histories. Remove unnecessary input at the source rather than asking a reviewer to spot exposure after generation. If a task cannot be completed without restricted material, route it to an approved human process rather than expanding permissions informally.

Access should correspond to roles. The person drafting may need process facts but not donor records. The person approving public wording needs evidence for claims and authority to reject them. An owner must be able to pause the workflow. These roles may be held by the same person in a small organisation, but the responsibilities still need to be distinguishable.

A useful record is proportionate. Keep input version, task, output, checks, approval and incidents where appropriate, but do not preserve unnecessary sensitive material merely to create an audit trail. Retention and deletion arrangements need an organisation-approved process. The course's local fictional workbook avoids making a live-data retention decision on the learner's behalf.

Make human review meaningful

Human review is not a person clicking approve after reading fluent text. The reviewer needs competence, time, source access, authority and a checklist aligned with the risks. For an advice explanation, check eligibility, service scope, availability, next step and limits. For a fundraising claim, check the specific evidence and representation as well as the wording.

Specify what stops publication. A missing source for a consequential claim, an invented testimonial or an unconfirmed service promise should prevent use until corrected. Do not let an average quality score offset a critical failure. The reviewer should know how to return the task to manual drafting and how to record the reason.

Independence can matter when the drafter is strongly invested in a campaign. A second competent perspective may identify overclaims or exclusion that the author missed. This course provides self-review tools but does not pretend they are independent professional approval. Actual review remains an external prerequisite for public claims about academic standing, legal suitability or validated outcomes.

Represent people without fabricating authority

A fictional story should be labelled where it is encountered, not only in a separate policy. Do not present an invented quotation as a service-user testimonial. Synthetic images or voices can imply real events or endorsements; if a project needs them, it needs specific review of disclosure, permissions and likely interpretation. They are unnecessary for completing this course.

Consider whether a story gives someone agency or reduces them to a fundraising device. What choices do they appear to have? What context is missing? Could a viewer infer that all people in a group share this experience? A representation review should include the affected perspective where it can be obtained appropriately, not merely the team's preferred interpretation.

Accessibility is also an accountability question. If a communication depends on video, a complex graphic or an inaccessible form, who checks the alternative route and who maintains it? A promise to add accessibility later leaves people excluded now. In this course, essential resources are plain text, but that does not establish accessibility of a future delivery platform.

Plan for a failure before it happens

Use a simple incident sequence: pause the affected workflow, preserve only appropriate evidence, assess possible harm with the relevant owner, correct or withdraw the output through authorised channels, use the manual fallback and review the cause before restart. Do not invent an automatic obligation to contact particular parties; notification and remedial actions require the organisation's current professional and procedural advice.

Distinguish a wording error from a structural failure. If the same unsupported promise keeps appearing because the brief rewards certainty, correcting each sentence is not enough. Change the approved inputs, acceptance criteria or workflow boundary. If reviewers lack time, reduce the task scope rather than labelling the process human-supervised on paper.

Write a policy someone can use

A project policy should name allowed tasks, prohibited tasks, input rules, approval roles, checks, escalation, fallback and review triggers. Include a short example of an acceptable output and a rejected one. Explain how the policy applies to the particular organisation, not just to a generic technology.

The linked sector guidance is a reference for further appraisal, not evidence that this course has checked current obligations. Compare it with your proposed controls and identify unanswered questions for competent reviewers. The final test is whether a person can tell when to proceed, when to stop and what to do next without improvising a permission decision under pressure.

Walk through a stop decision

Suppose an internal draft contains the claim 'guaranteed same-day advice'. The approved fictional input has no response deadline. The reviewer should not ask the model whether the guarantee is probably true; the missing authority is operational evidence. Mark the clause unsupported and prevent it from becoming public wording. If a service owner later confirms a narrower promise, update the approved input and repeat the affected check rather than treating the old approval as reusable forever.

Now suppose the drafter used a real client story despite the fictional-input boundary. Rewriting the final sentence does not address the input exposure. Pause the workflow and refer the situation to the organisation's appropriate privacy or incident owner. The course does not prescribe a legal notification outcome; it identifies why a competent authorised assessment is needed. Keep unrelated safe work moving, such as revising the fictional fact sheet or clarifying the task boundary.

For restart, ask what structural change prevents recurrence. A clearer input pack, restricted access, a smaller task or a mandatory source check may be more useful than another reminder to be careful. The proposed owner must be able to carry out the control within the available time. If not, reduce the scope or retain a manual process. A governance design is credible when it names a real stopping point and an achievable next action, not when it declares every risk managed by a policy document.

Study allocation and completion

Allocate 1.5 hours to this lesson and worked example, 1.5 to critical reading, 2 to the lab, 3 to the assignment, 1 to critique and 1 to reflection and revision: 10 hours in total. These are planning allocations, not measured duration or a timed assessment. Read in short sessions if helpful. All resources are plain text; a notebook, calculator or optional free spreadsheet is sufficient. No video, AI account or paid service is needed.

For critical reading, use the linked selection if accessible and the internal reading comparison. Record its question, argument, evidence type, assumptions and one reason it might not transfer to your organisation. A missing external reading does not prevent completion: compare the two original internal positions and state that you have not appraised the external source. Keep a source log with title, URL, access date if accessed, claim supported and limitation. Links are references, not permission to copy or upload readings to AI.

Complete the lab manually first. The supplied simulated AI output is authored teaching material, not a transcript, real research or verified model performance. Mark each claim supported, unsupported or contradicted. Optional live AI may generate alternatives from these fictional inputs only; record tool, date, instructions, checks and revisions. Never supply personal, confidential or unauthorised material. If not using AI, compare the supplied output against your manual work and label that route accurately.

For critique, use the rubric and annotated example, alone or with a consenting peer; no peer is required. For reflection, revise one consequential decision and record the old choice, new choice, evidence and unresolved uncertainty. Keep work locally. Self-completion records learning activity, not professional competence or an independently assessed award. Version: 1 November 2026; report suspected errors through the course host's available contact route, or retain a correction note if no route exists.

Practical lab — 2 hours

Classify the five tasks in the resource by consequence, input sensitivity and permission uncertainty. For each, decide proceed with fictional material, seek authorised review or do not use in this course. Run a tabletop incident: a draft invents same-day advice and is mistakenly marked ready. Describe pause, checks, authorised correction route and restart conditions without actually publishing or notifying anyone.

Portfolio assignment — 3 hours

Write an 800-word project AI/use policy and a one-page review checklist. Name responsibility roles, allowed and prohibited inputs, task scope, factual and representation checks, accessibility, escalation, manual fallback and restart evidence. Record unresolved legal/privacy/safeguarding questions and the competent role needed, rather than asserting compliance.

Critique — 1 hour

Use the rubric and annotated example, alone or with a consenting peer. Challenge your preferred option, a missing owner and a possible harmful consequence.

Reflection and revision — 1 hour

Change one consequential choice and keep a revision note. State what evidence would reverse the revised decision. No live contacts, spend, AI account or publication are required.

Self-review weights: evidence and source appraisal 25%; critical reasoning 25%; contextual fit 20%; feasibility and evaluation 20%; clarity and reflective judgement 10%. Score each 0–4 and sum(weight × score / 4). These are illustrative learning criteria, not validated academic grades.

Evidence: distinguish sector guidance from verified current requirements. Reasoning: connect controls to specific harms. Context: include representation and accessibility as well as data. Feasibility: give reviewers time and authority to stop. Reflection: change the workflow if sentence-level corrections keep recurring.

0 means absent or misleading; 1 asserts without support; 2 supplies partial relevant support; 3 links evidence, alternatives and feasible action; 4 tests a strong contrary account and defines a reversal condition. Invented evidence, privacy breaches and unsupported public promises require correction before self-completion regardless of the score.

Weak: 'A human will review everything, so the tool is compliant.' Review and compliance are both undefined. Competent: 'Only approved fictional inputs; check claims before any use.' Strong: 'The drafting owner checks every factual clause against input F1. The service owner must confirm any availability promise; missing confirmation blocks use. If an unsupported promise escapes, pause the workflow and revert to the approved manual explanation while an authorised owner assesses correction. Restart requires a revised brief and a clean check.' Annotation: this is a usable control design, not a legal opinion or proof an incident response has been exercised in production.